Allow users to install programs on client machines and use USB devices, in sbs 2011.

Posted on 2011-10-31
Last Modified: 2013-12-02
This is at the request of the owner, its a small office, 7 machines, and they want to be able to install their own apps like itunes, acrobat etc, also have to ability to use USB devices.

What do I have to do to make this happen.  Is there a way to allow updates for itunes, or microsoft security essentials, without allowing all exes?

Question by:savethehumans
    LVL 18

    Expert Comment

    by:Don S.
    The way I grant install (local administrative) privileges is to make a global group a member of the local computer's administrators group.  Then I can make a user a member of that global group (and therefore the ability to install programs) from ADUC without ever having to revisit the local computer.  Of course, this is highly inadvisable because most end users do not know what they are doing and will likely mess up their computers and more.  I know, you may not have a choice, they just want to be able to do anything they want.  In any case, setting it up like this will allow you to easily  grant and revoke that ability when needed.  Some programs can be updated without admin privileges, most non- Microsoft ones cannot - at least using their own builtin update mechanisms.  That is why most larger networks deploy updates like that centrally using various methods such as GPO, System center or other third party systems.

    Author Comment

    I dont totally understand what you are saying here, can you please elaborate a bit...

    "grant install (local administrative) privileges is to make a global group a member of the local computer's administrators group."
    LVL 18

    Accepted Solution

    A user must be a member of their computer's administrators group in order to install most software.  By making a domain global group (call it Local admin as an example) a member of each computer's administrator's group,it sets up the ability to grant install privileges by adding the user to a domain group instead of going to each PC to do that for each user and for every time something changes or moves.
    LVL 77

    Assisted Solution

    by:Rob Williams
    Though using the group method is standard practice with Windows servers, SBS is a different product and wizards should always be used when possible. In the SBS console under users and groups | users | user name -properties | computers | you can select a computer and change whether a user is to be a basic user or a LOCAL admin. If you are going to make a large number of users admins of a large number of computers this is not practical and you may want to use the groups method, but most often you want to make just the primary user an admin of their own machine.

    Also, when you join new computers to an SBS domain properly using the http://connect wizard you are given the choice of which users to assign to the machine and whether they will be basic users or admins of that machine.

    Featured Post

    Want to promote your upcoming event?

    Are you going to an event? Are you going to be exhibiting at a tradeshow? Talking at a conference? Using a promotional banner in your email signature ensures that your organization’s most important contacts stay in the know and can potentially spread the word about the event.

    Join & Write a Comment

    If you are a user of the discontinued Microsoft Office Accounting 2008 (MSOA) and have to move to a new computer running Windows 8, you will be unhappy to discover that it won't install.  In particular, Microsoft SQL Server 2005 Express Edition (SSE…
    Not many admins are aware that GPOs can be activated and deactivated time-based. Time to change that :)
    Sending a Secure fax is easy with eFax Corporate ( First, Just open a new email message.  In the To field, type your recipient's fax number You can even send a secure international fax — just include t…
    Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…

    734 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    22 Experts available now in Live!

    Get 1:1 Help Now